On this page
What it is, brieflyBuild the loss model firstWhat insurance transfersHow to treat the costRecords that need to surviveRetention and deletionQuestions to ask internallyWhere Firevault fitsFinance leaders are routinely asked to approve cyber controls in the language of technology. The more useful starting point is financial: what happens when the systems the organisation relies on are no longer trusted, and what does each additional day before recovery cost?
That changes the conversation. A backup is not valuable simply because it exists. Its financial value comes from whether the organisation can recover from it, how quickly that recovery can begin, and whether the copy itself survived the incident.
The UK National Cyber Security Centre makes the same distinction in practical terms: ransomware actors often target backups and infrastructure specifically to make recovery harder. Its guidance recommends making it possible to isolate backup solutions and maintaining backups that are separated from the live environment.
What Offline Secure Storage is, briefly
Offline Secure Storage® is dedicated physical storage held on real drives, with the storage physically disconnected from the network when access is not required. There is no standing route from the operating estate to the protected copy.
When an authorised user needs access, Firevault creates a controlled access window using a command path that sits outside the data network. When the session ends, the physical path is removed again.
For Finance, the important point is not the switching mechanism itself. It is the consequence: an attacker operating through compromised endpoints, network credentials or an administrator account cannot simply traverse the estate and reach a storage device for which no network path currently exists.
Offline is a state, not a synonym for “backup”. A backup can be encrypted, immutable or heavily permissioned and still be reachable. Offline Secure Storage is designed around the absence of the path itself when the copy is not in use.
Build the loss model first
Finance does not need a perfect probability model before it can assess recovery risk. A small number of inputs are enough to make the exposure visible and to compare the likely loss with the cost of reducing it.
Interruption cost per day
Gross margin foregone, fixed cost that continues, contractual penalties or service credits, and the cost of manual workarounds. Calculate it by function where possible because the impact is rarely uniform.
Credible recovery duration
Use the tested time to rebuild from a copy that can genuinely be trusted. If it has not been tested, use an honest range rather than the recovery time objective written in a plan.
Response and remediation
Incident response, forensics, legal support, notification, communications, overtime, contractors and infrastructure replacement.
Second-order effects
Lost pipeline, delayed contracts, renegotiations, audit consequences, insurance repricing and management time consumed after operations resume.
The point of the model is not to pretend that cyber loss can be forecast to the pound. It is to put the exposure and the control into the same currency. That makes the decision reviewable by the board rather than dependent on technical confidence alone.
What cyber insurance transfers, and what it does not
Cyber insurance can be an important part of the risk-financing strategy. It may contribute to specified first-party and third-party losses and provide access to specialist response services, subject to the exact policy wording, limits, exclusions, retentions and conditions.
It is not a replacement for recovery capability. The NCSC's guidance is explicit that cyber insurance does not prevent an attack and that organisations still need appropriate security measures in place.
Cyber insurance
- Transfers specified financial consequences subject to the policy.
- May fund or arrange specialist incident-response support.
- Operates after an insured event has occurred.
- Depends on policy terms, evidence and conditions being met.
Recovery isolation
- Reduces dependency on the compromised estate.
- Protects a recovery copy before an incident occurs.
- Can reduce the time before trustworthy recovery begins.
- Is a control rather than a financial-transfer instrument.
For Finance, the useful question is therefore not “insurance or storage?” They address different layers of the problem. One helps finance defined consequences. The other is intended to reduce the operational loss that creates those consequences in the first place.
Check what the organisation has represented to its insurer about backups, segregation, restore testing and incident controls. The specific impact on premium or claim response depends on the insurer and policy. Do not assume that one control automatically changes cover.
How to treat the cost
Offline Secure Storage is easiest to appraise as resilience expenditure against a defined interruption exposure. The comparison is not with the cost of ordinary cloud storage per gigabyte. The relevant benchmark is the loss associated with being unable to recover the subset of data the organisation needs to restart.
That protected subset should usually be much smaller than the whole estate. The objective is not to copy everything simply because storage exists. It is to identify the records that would be expensive, slow or impossible to reconstruct after a serious compromise.
A fixed-capacity, dedicated model also makes the budget more predictable than metered consumption. For a finance paper, the strongest comparison is the annual control cost against the organisation's own measured interruption exposure, using a range of recovery durations rather than a single best-case assumption.
The financial records that need to survive
Finance owns more of the recovery-critical data set than it often appears to. If the wider estate became unavailable, the finance function would still need enough evidence to pay people, receive money, establish the organisation's position and satisfy external scrutiny.
Illustrative record set, not a screenshot of a customer environment. The point is to show the type of finance evidence that may justify a separate offline copy.
The selection test is practical: could the organisation continue essential financial operations and prove its position without this record? If the answer is no, Finance should know where the isolated recovery copy is and how it would be accessed.
Retention, deletion and residual liability
Recovery planning and data retention should be considered together. Keeping a record may be necessary for legal, regulatory, contractual or operational reasons, but keeping everything indefinitely increases the amount of material that must be secured and governed.
The ICO's storage-limitation guidance says organisations should be able to justify how long personal data is retained, review it periodically, and erase or anonymise it when it is no longer needed. That turns retention from a storage habit into a governance decision.
Retention with intent
Define what must be kept, why it is kept, who owns the decision and when the requirement ends. Separate operational convenience from genuine retention need.
Verifiable deletion
Where data no longer needs to remain in connected systems, deletion reduces the reachable attack surface. If a record must still be retained for evidence or recovery, an isolated copy can allow the organisation to retain it without leaving the same standing access path in place.
The questions to ask internally
A finance-led resilience review does not need to begin with product specifications. Begin with the questions that expose assumptions.
Those questions create a useful bridge between Finance, Technology, Security, Legal and the board. They also make it easier to distinguish a recovery capability that has been demonstrated from one that exists only in policy documents.
Where Firevault fits
Firevault provides Offline Secure Storage® as a physically isolated copy behind the organisation's existing backup and data arrangements. Data is held on dedicated physical hardware in a Firevault Bunker, with the storage secured offline by default and access created only for authorised windows.
That makes it a complementary resilience layer rather than a replacement for production storage, day-to-day backup tooling or cyber insurance.
The finance case ultimately rests on duration. If the organisation can begin recovery from a trusted copy without first depending on the compromised environment, it has removed one of the variables that can turn a technical incident into a prolonged business interruption.
Sources & further reading
- UK National Cyber Security Centre, Ransomware-resistant backups, including the principle that backup solutions should be capable of isolation.
- UK National Cyber Security Centre, Cyber insurance guidance, on understanding business interruption, policy scope and the controls organisations remain responsible for.
- Information Commissioner's Office, Storage limitation, on justifying retention periods and deleting or anonymising data that is no longer required.
Mark Fermor
Focused on Offline Secure Storage and creating practical ways for organisations to keep recovery-critical data beyond the standing reach of the connected estate.